content-type may contain more the just 'application/jwt'